Splunk Search

Use wildcard in source?

nishantjiit
New Member

I have a directory C:\logs

in this directory I have multiple files:

1: logging-projectname-0.log (There can be multiple files like *-1.log, *-2.log etc..)
2: logging-projectname-batch-0.log (There can be multiple files like *batch-1.log, *batch-2.log etc..)

I only want to search the files like #1. So, I tried ---- source="c:\logs\logging-projectname-[0-9]{1,}.log" SEARCH_STRING

It's not working. Can anyone suggest?

Thanks in advance.

0 Karma
1 Solution

somesoni2
Revered Legend

Another option would be this

your base search | regex source="c:\\\\logs\\\\logging-projectname-\d+\.log"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

source uses wildcards, not regular expressions. somesoni2's suggestion should work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Another option would be this

your base search | regex source="c:\\\\logs\\\\logging-projectname-\d+\.log"

nishantjiit
New Member

Thanks it worked

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@nishantjiit, please accept an answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

skalliger
Motivator

Why don't you just use a wildcard like you mentioned it yourself?
Nevermind that.

Skalli

edit: deleted my search string.

0 Karma

xavierashe
Contributor

This should be an OR, not an AND.

0 Karma

skalliger
Motivator

Oh, you're correct. I've misread that. Thought he wants only one but not the other one.

I'll edit it.

0 Karma

horsefez
Motivator

@skalliger
stop being a noob 😛 😄

0 Karma

skalliger
Motivator

Should have deleted my comment. 😄

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...